Home / ubuntu / Questions / 47045
Accepted
takeshin
Asked: 2011-06-06 02:59:55 +0800 CST

Tutorial on making use of logs

  • 772

I know I can find logs in /var/log/, they contain powerful information, but I don't really use them often (on desktop or server).

Is there any good guide to learn how to make use of system logs on Ubuntu? Top things an user/basic admin needs to know?

E.g.

  • check this log weekly
  • keep this file clean
  • set up log notification this way
  • when somethings wired happened, start here
  • use this tool to simplify your life
  • common command line usages
  • common uses of grep searching the logs

or any other tips to new users coming from Windows?

log

2 Answers

  1. Best Answer

    1st have a look at the answer by MaroCeppi here: Which logs should I pay attention to? It explains what some of the more common logs are used for. There is one more log named .xsession-errors in your home dir (and this records your login and has amongst others errors on loading indicators and laucher items), and often grows VERY large, especially if you never log out.

    In general there is no need to check logs weekly. Security might be an exception but if that's the case your system probably is hosting a server (Apache for instance) and then it is more for seeing irregular access instead of errors. I tend to not look at them unless something is really broken.

    Specifically targeting your questions:

    use this tool to simplify your life

    log file viewer is a good place to start:

    im1

    set up log notification this way and when somethings wired happened, start here

    It is a bit hard to answer this but I always start with dmesg or with the log related to the problem (no need to look in .xsession-errors when you get an error during booting ;) )

    common command line usages and common uses of grep searching the logs

    Commands that are rather useful:

    cat will list the whole file.

    grep will filter commands.

    tail -f will keep a file active and you will see new notices show up in it when they happen. Rather helpful when tracking down what action you do results in a problem. (tail -100 will show the last 100 lines)

    wc -l to count how many times some search happend.

    more and less show the file too.

    One example of this:

    How many times did someone try to login on 'our' apacher server using IP address 111.111.111.111: grep "GET /login.js" /var/log/httpd/access.log | grep 111.111.111.111 | wc -l

    • 2

  2. Just after an "event" that you need to investigate, do a ls -rlt /var/log to get a reversed, time-ordered (by modification time) list of log files (most recently modified file last) to look at.

    • 1